Chapter 7 Lab 7-2, Using the AS_PATH Attribute

Transcription

1 Chapter 7 Topology Objectives Use BGP commands to prevent private AS numbers from being advertised to the outside world. Use the AS_PATH attribute to filter BGP routes based on their source AS numbers. Background The International Travel Agency s ISP has been assigned an AS number of 300. This provider uses BGP to exchange routing information with several customer networks. Each customer network is assigned an AS number from the private range, such as AS Configure the ISP router to remove the private AS numbers from the AS Path information of CustRtr. In addition, the ISP would like to prevent its customer networks from receiving route information from International Travel Agency s AS 100. Use the AS_PATH attribute to implement this policy Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 8

2 Note: This lab uses Cisco 1941 routers with Cisco IOS Release 15.4 with IP Base. The switches are Cisco WS- C TT-L with Fast Ethernet interfaces, therefore the router will use routing metrics associated with a 100 Mb/s interface. Depending on the router or switch model and Cisco IOS Software version, the commands available and output produced might vary from what is shown in this lab. Required Resources 3 routers (Cisco IOS Release 15.2 or comparable) Serial and Ethernet cables Step 0: Suggested starting configurations. a. Apply the following configuration to each router along with the appropriate hostname. The exec-timeout 0 0 command should only be used in a lab environment. Router(config)# no ip domain-lookup Router(config)# line con 0 Router(config-line)# logging synchronous Router(config-line)# exec-timeout 0 0 Step 1: Configure interface addresses. b. Using the addressing scheme in the diagram, create the loopback interfaces and apply IPv4 addresses to these and the serial interfaces on SanJose (R1), ISP (R2), and CustRtr (R3). The ISP loopbacks simulate real networks. Set a clock rate on the DCE serial interfaces. SanJose(config)# interface Loopback0 SanJose(config-if)# ip address SanJose(config-if)# exit SanJose(config)# interface Serial0/0/0 SanJose(config-if)# ip address SanJose(config-if)# clock rate SanJose(config-if)# no shutdown SanJose(config-if)# end ISP(config)# interface Loopback0 ISP(config-if)# ip address ISP(config-if)# interface Serial0/0/0 ISP(config-if)# ip address ISP(config-if)# no shutdown ISP(config-if)# exit ISP(config)# interface Serial0/0/1 ISP(config-if)# ip address ISP(config-if)# clock rate ISP(config-if)# no shutdown ISP(config-if)# end CustRtr(config)# interface Loopback0 CustRtr(config-if)# ip address CustRtr(config-if)# exit CustRtr(config)# interface Serial0/0/1 CustRtr(config-if)# ip address CustRtr(config-if)# no shutdown CustRtr(config-if)# end CustRtr# 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 8

3 c. Use ping to test the connectivity between the directly connected routers. Note: SanJose will not be able to reach either ISP's loopback ( ) or CustRtr's loopback ( ), nor will it be able to reach either end of the link joining ISP to CustRtr ( and ). Step 2: Configure BGP. a. Configure BGP for normal operation. Enter the appropriate BGP commands on each router so that they identify their BGP neighbors and advertise their loopback networks. SanJose(config)# router bgp 100 SanJose(config-router)# neighbor remote-as 300 SanJose(config-router)# network mask ISP(config)# router bgp 300 ISP(config-router)# neighbor remote-as 100 ISP(config-router)# neighbor remote-as ISP(config-router)# network mask CustRtr(config)# router bgp CustRtr(config-router)# neighbor remote-as 300 CustRtr(config-router)# network mask b. Verify that these routers have established the appropriate neighbor relationships by issuing the show ip bgp neighbors command on each router. show ip bgp neighbors BGP neighbor is , remote AS 65000, external link BGP version 4, remote router ID BGP state = Established, up for 00:00:28 Last read 00:00:28, last write 00:00:28, hold time is 180, keepalive interval is 60 seconds BGP neighbor is , remote AS 100, external link BGP version 4, remote router ID BGP state = Established, up for 00:01:34 Last read 00:00:33, last write 00:00:06, hold time is 180, keepalive interval is 60 seconds Step 3: Remove the private AS. a. Display the SanJose routing table using the show ip route command. SanJose should have a route to both and Troubleshoot if necessary. show ip route Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP a - application route + - replicated route, % - next hop override Gateway of last resort is not set C L /8 is variably subnetted, 4 subnets, 2 masks /24 is directly connected, Loopback /32 is directly connected, Loopback Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 8

4 B /24 [20/0] via , 00:04:22 B /24 [20/0] via , 00:03: /24 is variably subnetted, 2 subnets, 2 masks C /30 is directly connected, Serial0/0/0 L /32 is directly connected, Serial0/0/0 b. Ping the address from SanJose. Why does this fail? c. Ping again, this time as an extended ping, sourcing from the Loopback0 interface address. ping Protocol [ip]: Target IP address: Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: y Source address or interface: Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds: Packet sent with a source address of !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/28 ms Note: You can bypass extended ping mode and specify a source address using one of these commands: ping source or ping source Lo0 d. Check the BGP table from SanJose by using the show ip bgp command. Note the AS path for the network. The AS should be listed in the path to show ip bgp BGP table version is 5, local router ID is Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP,? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> / i *> / i 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 4 of 8

5 *> / i Why is this a problem? e. Configure ISP to strip the private AS numbers from BGP routes exchanged with SanJose using the following commands. ISP(config)# router bgp 300 ISP(config-router)# neighbor remove-private-as f. After issuing these commands, use the clear ip bgp * command on ISP to reestablish the BGP relationship between the three routers. Wait several seconds and then return to SanJose to check its routing table. Note: The clear ip bgp * soft command can also be used to force each router to resend its BGP table. clear ip bgp * *Sep 8 18:40:03.551: %BGP-5-ADJCHANGE: neighbor Down User reset *Sep 8 18:40:03.551: %BGP_SESSION-5-ADJCHANGE: neighbor IPv4 Unicast topology base removed from session User reset *Sep 8 18:40:03.551: %BGP-5-ADJCHANGE: neighbor Down User reset *Sep 8 18:40:03.551: %BGP_SESSION-5-ADJCHANGE: neighbor IPv4 Unicast topology base removed from session User reset *Sep 8 18:40:04.515: %BGP-5-ADJCHANGE: neighbor Up *Sep 8 18:40:04.519: %BGP- 5-ADJCHANGE: neighbor Up show ip route /8 is variably subnetted, 4 subnets, 2 masks C /24 is directly connected, Loopback0 L /32 is directly connected, Loopback0 B /24 [20/0] via , 00:00:20 B /24 [20/0] via , 00:01: /24 is variably subnetted, 2 subnets, 2 masks C /30 is directly connected, Serial0/0/0 L /32 is directly connected, Serial0/0/0 Does SanJose still have a route to ? SanJose should be able to ping using its loopback 0 interface as the source of the ping. ping source lo0 Type escape sequence to abort Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 5 of 8

6 Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds: Packet sent with a source address of !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/28/32 ms g. Now check the BGP table on SanJose. The AS_ PATH to the network should be AS 300. It no longer has the private AS in the path. show ip bgp BGP table version is 9, local router ID is Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP,? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> / i *> / i *> / i Step 4: Use the AS_PATH attribute to filter routes. As a final configuration, use the AS_PATH attribute to filter routes based on their origin. In a complex environment, you can use this attribute to enforce routing policy. In this case, the provider router, ISP, must be configured so that it does not propagate routes that originate from AS 100 to the customer router CustRtr. AS-path access lists are read like regular access lists. The statements are read sequentially, and there is an implicit deny at the end. Rather than matching an address in each statement like a conventional access list, AS path access lists match on something called a regular expression. Regular expressions are a way of matching text patterns and have many uses. In this case, you will be using them in the AS path access list to match text patterns in AS paths. a. Configure a special kind of access list to match BGP routes with an AS_PATH attribute that both begins and ends with the number 100. Enter the following commands on ISP. ISP(config)# ip as-path access-list 1 deny ^100$ ISP(config)# ip as-path access-list 1 permit.* The first command uses the ^ character to indicate that the AS path must begin with the given number 100. The $ character indicates that the AS_PATH attribute must also end with 100. Essentially, this statement matches only paths that are sourced from AS 100. Other paths, which might include AS 100 along the way, will not match this list. In the second statement, the. (period) is a wildcard, and the * (asterisk) stands for a repetition of the wildcard. Together,.* matches any value of the AS_PATH attribute, which in effect permits any update that has not been denied by the previous access-list statement. For more details on configuring regular expressions on Cisco routers, see: b. Apply the configured access list using the neighbor command with the filter-list option. ISP(config)# router bgp 300 ISP(config-router)# neighbor filter-list 1 out The out keyword specifies that the list is applied to routing information sent to this neighbor Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 6 of 8

7 c. Use the clear ip bgp * command to reset the routing information. Wait several seconds and then check the routing table for ISP. The route to should be in the routing table. Note: To force the local router to resend its BGP table, a less disruptive option is to use the clear ip bgp * out or clear ip bgp * soft command (the second command performs both outgoing and incoming route resync). clear ip bgp * *Sep 8 18:48:04.915: %BGP-5-ADJCHANGE: neighbor Down User reset *Sep 8 18:48:04.915: %BGP_SESSION-5-ADJCHANGE: neighbor IPv4 Unicast topology base removed from session User reset *Sep 8 18:48:04.915: %BGP-5-ADJCHANGE: neighbor Down User reset *Sep 8 18:48:04.915: %BGP_SESSION-5-ADJCHANGE: neighbor IPv4 Unicast topology base removed from session User reset *Sep 8 18:48:04.951: %BGP-5-ADJCHANGE: neighbor Up *Sep 8 18:48:04.955: %BGP- 5-ADJCHANGE: neighbor Up show ip route /8 is variably subnetted, 4 subnets, 2 masks B /24 [20/0] via , 00:00:29 C /24 is directly connected, Loopback0 L /32 is directly connected, Loopback0 B /24 [20/0] via , 00:00: /16 is variably subnetted, 2 subnets, 2 masks C /30 is directly connected, Serial0/0/1 L /32 is directly connected, Serial0/0/ /24 is variably subnetted, 2 subnets, 2 masks C /30 is directly connected, Serial0/0/0 L /32 is directly connected, Serial0/0/0 d. Check the routing table for CustRtr. It should not have a route to in its routing table. CustRtr# show ip route /8 is variably subnetted, 3 subnets, 2 masks B /24 [20/0] via , 00:00:32 C /24 is directly connected, Loopback0 L /32 is directly connected, Loopback /16 is variably subnetted, 2 subnets, 2 masks C /30 is directly connected, Serial0/0/1 L /32 is directly connected, Serial0/0/1 CustRtr# e. Return to ISP and verify that the filter is working as intended. Issue the show ip bgp regexp ^100$ command. show ip bgp regexp ^100$ BGP table version is 4, local router ID is Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP,? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 7 of 8

8 *> / i The output of this command shows all matches for the regular expressions that were used in the access list. The path to matches the access list and is filtered from updates to CustRtr. f. Run the following Tcl script on all routers to verify whether there is connectivity. All pings from ISP should be successful. SanJose should not be able to ping the CustRtr loopback or the WAN link /30. CustRtr should not be able to ping the SanJose loopback or the WAN link /30. tclsh foreach address { } { ping $address } 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 8 of 8